EcoPetróleo listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Dominican Republic
• Sector: Energy & Utilities
• Announcement date: October 14, 2025

Medusa ransomware group targets EcoPetróleo

The Medusa ransomware group has published a leak announcement on its dedicated leak site, claiming to have compromised data belonging to EcoPetróleo, an energy company based in the Dominican Republic. The announcement, which appeared on the group's platform on October 14, 2025, follows a claimed attack date of October 12, 2025. This development highlights the ongoing threat posed by ransomware groups that utilize public leak sites to pressure victims into paying ransoms.

In this instance, the threat actors are employing a double-extortion tactic. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive data before the encryption occurs. By threatening to release this stolen information publicly, the group aims to exert maximum pressure on the target organization to fulfill their demands.

Details of the claimed attack and ransom demand

According to the claim made by the Medusa group, the organization is being targeted for a ransom of 100,000 USD. The group has provided evidence to support their claim of a successful breach by publishing samples of documents and file trees that appear to be related to the company's internal operational processes. These samples serve as a visual confirmation of the group's access to the corporate environment.

The provided screenshots and data samples include various types of sensitive documentation. Based on the information released by the group, the following types of data are reportedly involved in the breach:

• Financial data
• Contractual documents
• Administrative records

The presence of such documentation in a public leak site suggests that the attackers have gained access to the core administrative and financial functions of the organization.

About EcoPetróleo

EcoPetróleo is an energy company operating within the Dominican Republic. The company is involved in the supply of petroleum products and places a significant focus on environmental conservation initiatives. Its operational model includes various corporate social responsibility projects, recycling programs, and the implementation of sustainable practices to balance its energy production and distribution with environmental stewardship.

Impact and risks of the data exposure

The actions taken by the Medusa group indicate that EcoPetróleo faces a significant risk regarding the exposure of its sensitive commercial and operational data. The leakage of such information can have far-reaching consequences for the organization. Primarily, the exposure of internal documents could weaken the company's competitive advantage in the energy market. Furthermore, such a breach can lead to a substantial loss of corporate reputation among partners, stakeholders, and the public.

Beyond the immediate commercial impact, there are significant legal and security implications. The organization may face legal sanctions under the data protection regulations established within the framework of the Dominican Republic. Additionally, the leaked documents may contain information regarding employees or customers. If this information is accessed by third parties, it could be utilized for malicious purposes, such as identity theft or targeted phishing attacks against individuals associated with the company.

For organizations operating in the energy and utilities sector, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive strategies typically involve maintaining rigorous data protection protocols, implementing multi-factor authentication, and ensuring regular, offline backups of critical data. Furthermore, maintaining a comprehensive incident response plan is essential for mitigating the impact of both data exfiltration and system encryption during a ransomware event.